There was a conference call with reporters about the subject, so the press release public release was not the first the NYT knew about it. They likely had an embargo agreement.
It's often in the interest of the reporter to agree to stuff like this since publishing security issues ahead of time can have serious negative consequences.